v0.4.11

Consolidates the pre-1.0 gate-4 review hardening (0.4.3 through 0.4.11) into one release. Hardware-validated console-backed on the reference Protectli box (build b0317b6, 14/14 checks PASS): build-identity gate, M8 status dep-gate, H5 box-wide lease timing, M5 pending-delete drain, M6 restart-failure seen-set, P2 kill-mid-apply FIFO-EOF revert, and the L3-30 carrier-pull prune + re-add.

Highlights (full detail in CHANGELOG):

• P3: order-independent post-apply health check for equal-metric multi-uplink boxes
• M8: --status reports unavailable + non-zero when a detection tool is missing (no false "no trunk")
• M6: a total restart failure no longer marks a new subnet "seen" (retries next run; a partial success consumes)
• M5: a failed post-accept ip link delete is recorded and retried, not orphaned until reboot
• M4: additions are dropped on a trunk that lost carrier in the detection->apply window
• H5: the post-accept lease wait is one box-wide deadline, not per-VLAN in series
• H1: a failed capture method can no longer authorize a boot detection-diff removal
• M7: VLAN_LIMIT_MODE=fill keeps the lowest numeric IDs
• H6/M1: interface-name contract (IFNAMSIZ 15-char limit; refuse dotted parents; injective interface key)
• Removed the reserved-but-unimplemented PER_VLAN_MAC key (postinst migrates old conffiles)
• Packaging/CI: Debian prerm aborts on a lock timeout; the APT-repo rebuild no longer silently drops packages